XM Dump file from firmware 

Welcome In this video I'll show you how to make a Dump from the firmware Let's find out what kind of flash drive we have and open the datasheet for it In this case, we have XM25QH64C from the camera At 64 Mbit, if divided by 8 bits, it will be 8 MB Be sure to save Dump from a USB flash drive Therefore, the program indicates 8 MB And click Create dump We give a name to our empty Dump file I added to the saved words OLD_DUMP For this new empty file I add the words NEW_DUMP Click Open Firmware Choosing our firmware for the camera Checking the presence of all files from the firmware And click Add Check that the sizes of the new file and the old one are the same If the board has a FM24C08A flash drive, then no further action is required. You just need to flash the flash drive with the resulting Dump file If there is no FM24C08A flash drive, then we transfer the encrypted area with our MAC and ID to a new Dump Open both files We need to find the beginning of the encrypted area d2d4 I decided to find the beginning of uboot, by the word bootcmd, above uboot there will be our area of ​​1024 bytes Basically, its beginning is located at offsets 1fc00 or 2fc00 or 3fc00, rarely 4fc00 If anyone asks what I use for the editor, then this is Hex Editor Neo It did not work out quickly, but in the end I found the beginning of d2d4 We double-check that we correctly found the encrypted area 1fc00 - no 2fc00 - yes 3fc00 - no (for example) Back to 2fc00 Now we need to transfer 1024 bytes We check that we have copied everything to bootcmd Copy Ctrl+C Enter the beginning of the area 2fc00 (in this case) Paste Ctrl+V Check what was copied to bootcmd Save Ctrl+S Our Dump is ready Now we have an XM25QH128C flash drive from the registrar At 128 Mbit, which means 16 MB Be sure to save Dump from a USB flash drive We check that the volume of the flash drive is 16 MB Therefore, the program indicates 16 MB Click Create dump We give a name to our empty Dump file As for the last saved dump, I added the words OLD_DUMP For this new empty file I add the words NEW_DUMP Click Open Firmware Choosing our firmware for the registrar Checking the presence of all files from the firmware And click Add Check that the sizes of the new file and the old one are the same Now we will transfer the encrypted area with our MAC and ID to a new Dump Open both files Like last time, you need to find the beginning of the encrypted area d2d4 I decided to find the beginning of uboot, by the word bootcmd, above uboot there will be our area of ​​1024 bytes As I said earlier, the beginning of the region is located at offsets 1fc00 or 2fc00 or 3fc00, rarely 4fc00 In this case, by offset 3fc00 Copy 1024 bytes of area We check that we have copied everything to bootcmd You can also select the desired area by dragging the mouse to bootcmd Copy Ctrl+C Enter the beginning of the area 3fc00 (in this case) Paste Ctrl+V Check what was copied to bootcmd Save Ctrl+S Our Dump is ready In the folder with the program there is a file that contains standard offsets That's all See you again.